Skip to content
Metatext Decide — typed decisions for your agents, with a probability on every answerGet early access
Metatext
Sign Up

jev-injection-guard

OpenBles Firewall 1: open prompt-injection detector for agent inputs, with a Claude Code hook and an optional Jev backend.

MCP serverbetaMIT
View on GitHub ↗

Overview

This repository, renamed from jev-injection-guard to OpenBles Firewall 1, provides an open decision model that acts as a prompt-injection firewall for AI agents. It reads text an agent is about to consume (web pages, tool or MCP results, emails, files) and answers one question: is this text trying to give the agent orders? The 31.8 MB adapter is built on GLiNER2.5-Decide, trained on public human-labelled data in about 8 minutes on a MacBook, and runs offline at about 33 ms per text with no key. Weights are also on Hugging Face.

The repo includes the full guard: rules for hidden text, a Claude Code hook that withholds a poisoned tool result and blocks its source, and an optional hosted backend using Jev scored on the same sets. On held-out public test splits, the README reports 119 of 120 agent attacks caught with no clean texts flagged (F1 0.996) and 55 of 60 classic injections caught (F1 0.940); the Jev backend results are reported alongside.

What the decision model decides

TypeQuestionAnswers
ChoiceIs this text trying to give the agent orders?injection · benign

How it works

  1. Intercept text the agent is about to read
  2. Apply hidden-text rules
  3. Classify with the local model or Jev backend
  4. Withhold poisoned results and block the source in Claude Code

Strengths

  • Runs offline with open weights
  • Strong held-out results reported
  • Claude Code hook included

Caveats

  • Evaluated on two public datasets
  • Repository renamed; Jev is optional

Getting started

`pip install gliner2 safetensors`, then `from model.load_guard import load; m = load("model")`.

At a glance

Type
MCP server
Status
beta
Language
Python
Runtime
Local model plus Claude Code hook
Has code
yes
License
MIT

Use cases and integrations

How curated lists describe it

  • Find prompt injection in what an AI agent reads (web pages, tool and MCP results) with Jev, and block the source in Claude Code. Measured on public held-out sets.

    hellogumbo/awesome-jev

Frequently asked questions

What does the model decide?

Whether text is trying to give the agent orders.

Does it need Jev?

No, the open model runs offline; Jev is an optional backend.

How accurate is it?

The README reports F1 0.996 on agent attacks and 0.940 on classic injections.

Related projects

  • claude-code-templates

    Large catalog of Claude Code agents, commands, hooks and MCPs, listed with community Jev mods for guardrails and subagent models.

    CLIproductionJavaScript
  • jev-axi

    Agent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.

    PluginbetaTypeScript
  • jev-firewall

    PreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.

    HookbetaTypeScript
  • jev-guard (leepokai)

    Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.

    LibrarybetaTypeScript
  • jev-shield

    Semantic MCP firewall that screens tool calls, results and descriptions with Jev, plus allowlists and session taint tracking.

    MCP serverbetaTypeScript
  • reflex (ursuciprian)

    Pre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.

    ProjectbetaJavaScript